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DETAILED ACTION 
Claim Rejections - 35 USC § 102 

1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

2. Claims 1-6, 9-12, 14-19, 26-31, are rejected under 35 U.S.C. 102(e) as being anticipated 
by Bernstein et al(5,884,3 1 6). 

3. As per claims 1, 26, Bernstein et al discloses establishing a session on behalf of a 
user(see col. 4, lines 33-40, 59-67); receiving a request to enable database privileges for the 
user(see col. 5, lines 50-55, col. 6, lines 24-36); verifying trusted security logic has been 
executed prior to receiving the request to enable database privileges, wherein the act of verifying 
the trusted security logic includes verifying a proxy user; and enabling database privileges for the 
user if the trusted security logic has been executed prior to receiving the request to enable the 
database privileges(see col. 2, lines 50-67, col. 5, lines 50-55, col. 6, lines 24-36). 

4. As per claims 2, 15, 27, Bernstein discloses storing call information in one or more 
frames of a call stack(see fig. 3 sheet 4); and wherein the act of verifying includes determining 
whether the one or more frames of the call stack corresponds to the trusted security logic(see col. 

4, lines 40-50). 

5. As per claims 3, 16, 28, Bernstein discloses wherein the act of verifying the trusted 
security logic comprises verifying an application name(see col. 5, lines 1-26). 
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6. As per claims 4, 17, 29, Bernstein discloses wherein the act of verifying the trusted 
security logic further includes verifying a security function name(see col. 6, lines 24-36). 

7. As per claims 5, 18, 30, Bernstein discloses wherein the act of verifying trusted security 
logic comprises verifying a module name(see col. 6, lines 24-36). 

8. As per claims 6, 19, 31, Bernstein discloses collecting one or more session parameters; 
comparing the one or more session parameters against a set of trusted security parameters 
defined in a security function; and returning a result indicating whether the one or more session 
parameters matches the set of trusted security parameters(see col. 6, lines 36-50, 62-67). 

9. As per claim 9, Bernstein discloses a client-server computer system(see fig. 1 sheet 1, 
col. 3, lines 21-23), a computer including: a processor(see col. 3, lines 25-26), a main memory 
communicatively coupled to the processor(see col. 3, lines 25-30); and a disk storage 
communicatively coupled to the processor; a database running on the computer from the main 
memory(see col. 3, lines 45-67, col. 5, lines 50-55), the database further including: one or more 
data structures stored in the disk storage, and a call stack stored in the main memory(see col. 5, 
lines 1-22); an application program coupled to the database and configured to support a user; and 
a metadata repository embodied in the one or more data structures stored in the disk storage, the 
metadata repository comprising trusted security logic; wherein the application program is 
configured to initiate a call to enable database privileges(see col. 5, lines 50-55, col. 6, lines 24- 
36), the call causing call information to be stored in one or more frames of the call stack and one 
or more security functions to be executed; and wherein the database is configured to: verify the 
call stack comprises one or more frames corresponding to the trusted security logic; test a proxy 
user; and enable database privileges for the user if the trusted security logic is contained in the 
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one or more frames of the call stack(see col. 2, lines 50-67, col. 5, lines 50-55, col. 6, lines 24- 
36). 

10. As per claim 10, Bernstein discloses wherein the application program resides with the 
database in the computer(see col. 5, lines 50-55). 

11. As per claim 1 1 , Bernstein discloses wherein the application program resides on a 
separate computer communicatively coupled to the database(see col. 5, lines 50-63). 

12. As per claim 12, Bernstein discloses wherein the trusted security logic includes a schema 
name and a security package name(see col. 5, lines 50-55, col. 6, lines 24-49). 

13. As per claim 14, Bernstein discloses have stored therein one or more sequences of 
instructions for enabling privileges(see col. 5, lines 50-55, col. 6, lines 24-36), the one or more 
sequences of instructions causing one or more processors to perform a number of acts, said acts 
including establishing a session on behalf of a user(see col. 4, lines 33-40, 59-67); receiving a 
request to enable database privileges for the user; verifying trusted security logic has been 
executed prior to receiving the request to enable database privileges, wherein the act of verifying 
the trusted security logic includes verifying a proxy user; and enabling database privileges for the 
user if the trusted security logic has been executed prior to receiving the request to enable the 
database privileges(see col. 2, lines 50-67, col. 5, lines 50-55, col. 6, lines 24-36). 

Claim Rejections - 35 USC § 103 

14. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
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having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

15. Claims 8, 21, 32, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Bernstein(5,884,316) in view of Fisher et al(6,092,189). 

1 6. As per claims 8, 21 , 32, Bernstein does not disclose receiving information identifying the 
user; prompting the user for a password; authenticating the user based on information stored in 
an application program; and associating the user with a role. As per claims 8, 21, 32, Fisher 
discloses receiving information identifying the user; prompting the user for a password(see col. 
15, lines 42-44); authenticating the user based on information stored in an application program; 
and associating the user with a role(see col. 15, lines 45-51, col. 31, lines 30-34). It would have 
been obvious to one of ordinary skill in the art at the time of the invention to include receiving 
information identifying the user, prompting the user for a password, authenticating the user 
based on information stored in an application program; and associating the user with a role of 
Fisher with Bernstein, because database security is maintained through the control of access to 
the database tables by the DBMS. Data that is considered privileged can be protected from 
access by those persons or programs that should not see it(see col. 39, lines 54-67 of Fisher). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jenise E. Jackson whose telephone number is (571) 272-3791. 
The examiner can normally be reached on M-Th (6:00 a.m. - 3:30 p.m.) alternate Friday's. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Shiekh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 



Application/Control Number: 10/600,388 



Page 6 



Art Unit: 2131 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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